Micro Billing System scam

superscaper

superscaper wrote: »

Just had a thought, I presume a Mac or Linux (or even Acorn ) machine wouldn't even run the MBS popup. If they were concerned about genuine payment then why target only (relatively) security vulnerable systems?

That would annoy them, emails taunting MBS with "I'm viewing all your pron for free with my nice shiny mac".

marleyboy

superscaper wrote: »

That would annoy them, emails taunting MBS with "I'm viewing all your pron for free with my nice shiny mac".

:rotfl: Love it!!!!!

iolanthe07

prevx has worked absolutely fine for me for getting rid of this menace. It's free for a month too, though I am going to pay the £14 annual subscription out of sheer gratitude! I've had no problems at all with any collateral issues - maybe using mozilla firefox helps. I always avoid using Internet Explorer if I can.

smudge232

we keep getting the same bill pop up.
I called the customer services this morning and they advised that we have been on the site several times from the 13th july to today. This is not the case and they advised that the could prove this as they have our ip address.
When logging on this morning the bill popped up and then another pop up occurred of a sexual nature. To be honest I think this is how they are saying we are using the site by sending pop ups through the internet.
I have contacted the bbc and they are going to investigate the matter. It does seem a big scam and we have tried everything stated in this forum but can not seem to get rid of it. Anyone else got any ideas?
Thanks

superscaper

smudge232 wrote: »

we keep getting the same bill pop up.
I called the customer services this morning and they advised that we have been on the site several times from the 13th july to today. This is not the case and they advised that the could prove this as they have our ip address.
When logging on this morning the bill popped up and then another pop up occurred of a sexual nature. To be honest I think this is how they are saying we are using the site by sending pop ups through the internet.
I have contacted the bbc and they are going to investigate the matter. It does seem a big scam and we have tried everything stated in this forum but can not seem to get rid of it. Anyone else got any ideas?
Thanks

Have you even tried a system restore? That seems most effective. I'm surprised at how many people actually contact the company, it would seem obvious to me that it wouldn't resolve anything, not least by the demonstration of their business practices.

iolanthe07

Anyone else got any ideas?

I repeat:

prevx has worked absolutely fine for me for getting rid of this menace. It's free for a month too, though I am going to pay the £14 annual subscription out of sheer gratitude!

Just to add: do not have any dealings with this company. Do not contact them by phone, fax, letter or e-mail. Keep an absolutely low profile. This scamware posts as legit through a kind of blackmail which might technically be legal, but needs to be tested in court, but it is best to let Trading Standards take them on. Do not pay them their Danegeld, just get rid of the same by Googling prevx (or any other good anti-malware program) and following the instructions.

RisingDamp

Smudge232: As you'll see on an earlier posting from me, this is already being run by You and Yours on BBC Radio 4 as a result of my bringing it to their attention. You may wish to contact Shari Vahl, who is the reporter who has been running with the story.

System Restore definitely works, but remember to remove all other restore points after doing your restore, then switch system restore back on afterwards to start creating new points (uncontaminated by MBS). You do need to go back to a time when you can be confident that the scamware wasn't on your machine - 10 days back from first pop up should well cover that.

But, while you're at it, make sure you contact Trading Standards, and a letter to your MP won't go amiss. Mine is already looking into it through the OFT, but the more people complain, the more seriously it will have to be taken.

It's good to know there are other people out there who aren't going to let this little outfit keep getting away with their scam.

marleyboy

As the above post mentions, the more people who complain about this wether victims or not, the quicker something will get done about it, IT CANNOT BE ALLOWED TO CONTINUE, if one shady little company can get away with this sort of blackmail, it wont be long before many others will jump onto the bandwagon, before we know it, people will be to scared to so much as browse the internet, for fear of falling into such a trap, and it could be so easy to innocently find yourself becoming a victim.

Alfonso_Skinarelli

It looks like the malware companies are paying no attention to MBS' threats. The installation file bares the following results when scanned at virustotal today.

File MBSAuthenticate_39.exe received on 07.25.2007 21:54:55 (CET)

Antivirus Version Last Update Result
AhnLab-V3 2007.7.26.0 2007.07.25 Win-Trojan/Agent.1804072
AntiVir 7.4.0.50 2007.07.25 TR/Agent.afi.5
Authentium 4.93.8 2007.07.25 W32/Trojan.AOGJ
Avast 4.7.997.0 2007.07.25 Win32:Agent-ERX
AVG 7.5.0.476 2007.07.25 Generic4.QJJ
BitDefender 7.2 2007.07.25 Application.Sexxxport.A
CAT-QuickHeal 9.00 2007.07.25 Trojan.Agent.afi
ClamAV 0.91 2007.07.25 Trojan.Agent-5121
DrWeb 4.33 2007.07.25 no virus found
eSafe 7.0.15.0 2007.07.24 Win32.Agent.afi
eTrust-Vet 31.1.5004 2007.07.25 no virus found
Ewido 4.0 2007.07.25 Trojan.Agent.afi
FileAdvisor 1 2007.07.25 no virus found
Fortinet 2.91.0.0 2007.07.25 W32/Agent.AFI!tr
F-Prot 4.3.2.48 2007.07.25 W32/Trojan.AOGJ
F-Secure 6.70.13030.0 2007.07.25 Trojan.Win32.Agent.afi
Ikarus T3.1.1.8 2007.07.25 Trojan.Win32.Agent.afi
Kaspersky 4.0.2.24 2007.07.25 Trojan.Win32.Agent.afi
McAfee 5082 2007.07.25 FakeBillPayment-A
Microsoft 1.2704 2007.07.25 no virus found
NOD32v2 2420 2007.07.25 probably a variant of Win32/Agent
Norman 5.80.02 2007.07.25 W32/Agent.BNOL
Panda 9.0.0.4 2007.07.24 Adware/SexPassport
Sophos 4.19.0 2007.07.17 Micro Bill Systems
Sunbelt 2.2.907.0 2007.07.25 MicroBillSys
Symantec 10 2007.07.25 Trojan Horse
TheHacker 6.1.7.153 2007.07.25 Trojan/Agent.afi
VBA32 3.12.2.1 2007.07.24 Trojan.Win32.Agent.afi
VirusBuster 4.3.26:9 2007.07.25 no virus found
Webwasher-Gateway 6.0.1 2007.07.25 Trojan.Agent.afi.5


If this continues, there won't be many cases of MBS left to fix.
Most Anti-virus software will kill it before it lands on the hard drive. :T

sra

** Board Guide Note **

Hi

Hope nobody minds - I've renamed this thread
(Hope the new title is appropriate - I've only skim-read the thread)

Was just a bit tired of seeing "mysexworld" every time I looked at the forum index.